Privacy Policy

Last updated: 16 October 2026

This Privacy Policy explains how personal information is handled when you use the 8D Motion mobile application, the website at 8dmotion.com, and related services.

8D Motion is operated by Jordan Markovics, trading as 8D Motion. Contact details are provided in Section 16.

Privacy in brief

8D Motion only uses the information needed to run your account, sync project details, manage subscriptions and keep the service working securely.

Your imported audio and video stay on your device and are not uploaded as part of normal cloud sync.

We do not use your information for advertising, track your location or build advertising profiles about you.

You can delete your account at any time, and you can contact us if you want to ask about, access or correct your information.

The full Privacy Policy below explains this in more detail.

1. Scope

This Privacy Policy applies to:

• the 8D Motion mobile application on iOS and Android;
• 8D Motion accounts;
• cloud project and preset syncing;
• 8D Motion Plus subscriptions;
• 8dmotion.com;
• account and security services used by 8D Motion; and
• support communications sent to 8D Motion.

This Privacy Policy does not govern the independent privacy practices of Apple, Google or other services that you choose to use separately from 8D Motion.

2. Information we collect and process

2.1 Account and authentication information

An account is required for account-based features of 8D Motion.

Depending on how you sign in, authentication may involve:

• your email address;
• a unique Supabase user ID;
• email/password authentication;
• Google Sign-In; or
• Sign in with Apple.

If you use email and password, your password is passed to Supabase Auth for authentication. 8D Motion does not store your password in its own database or logs.

If you use Google Sign-In, Google may provide identity information associated with the permissions requested for sign-in, including your email address and basic profile information. 8D Motion itself does not maintain a username, display-name or profile-photo feature and does not copy a Google profile photo or display name into an 8D Motion profile.

If you use Sign in with Apple, Apple may provide an email address and identity information as part of the authentication process. If you choose Apple’s Hide My Email feature, the email address available to 8D Motion may be an Apple private-relay address.

Supabase also creates authentication and security records for events such as sign-ins, sign-ups, email confirmation, password recovery and token refresh. These records may include information such as the user ID, IP address, user agent and authentication provider.

2.2 Projects and presets

When cloud syncing is used, 8D Motion stores project and preset metadata in Supabase.

For projects, this can include:

• project ID;
• project name;
• creation and update timestamps;
• Motion settings;
• Reverb settings;
• schema and revision information;
• source revision ID;
• original filename;
• original file extension;
• original file size;
• audio duration; and
• a SHA-256 hash derived from the original source file.

For presets, this can include:

• preset ID;
• preset name;
• creation and update timestamps;
• Motion and Reverb settings;
• favourite status; and
• schema and revision information.

Project names, preset names and original filenames can contain information that you choose to put into them.

2.3 Your audio and video files

8D Motion does not upload your imported audio or video files to the 8D Motion cloud backend.

When you import audio or video, 8D Motion uses the device’s native file or media picker to let you choose a specific item.

8D Motion then receives access to the item you selected, creates an app-private working copy and prepares the audio for processing locally. This includes converting or preparing the source audio in the format required by the app.

8D Motion does not require ongoing or unrestricted access to your files or media library after the import.

The following remain local to your device:

• the original media you selected outside 8D Motion;
• the app-private working copy;
• prepared audio used for processing;
• audio exports;
• waveform and cache data;
• local file paths; and
• device-specific sync bookkeeping.

Only the project metadata described in Section 2.2 is synced to the 8D Motion backend.

Original media outside 8D Motion’s private app storage is not modified or deleted by 8D Motion.

The app does not use your microphone, camera or location to provide its audio-editing features.

2.4 Subscription and purchase information

8D Motion Plus subscriptions are purchased through the Apple App Store or Google Play.

8D Motion does not receive or store your payment-card details.

Subscription management uses RevenueCat. 8D Motion identifies a RevenueCat customer using the same unique Supabase user ID associated with the 8D Motion account.

RevenueCat and the relevant app store process information needed to manage purchases and subscriptions. This can include:

• purchase history;
• product and store information;
• subscription status;
• purchase and expiry dates;
• renewal state;
• Apple receipt information or Google purchase tokens; and
• technical information about the device or platform used for the purchase.

8D Motion does not deliberately send RevenueCat your name, email address or phone number as customer attributes.

8D Motion’s own backend keeps subscription ownership and lifecycle information so that Plus access can be verified, restored and protected against conflicting or fraudulent ownership claims.

Raw Apple or Google transaction/order identifiers are not stored in the 8D Motion database. Where store transaction identifiers are needed by the backend, they are converted into one-way HMAC-derived keys before being persisted.

RevenueCat also provides a webhook to 8D Motion’s own backend so that subscription lifecycle changes can be processed. No third-party RevenueCat analytics, advertising or attribution integrations are currently enabled.

2.5 Security and bot protection

8D Motion uses Cloudflare Turnstile to help protect email-based authentication flows from automated abuse.

The 8D Motion Turnstile page does not receive your email address, password or Supabase user ID. The app provides a local attempt identifier, and Cloudflare supplies a short-lived verification token that is passed to Supabase Auth for verification.

8D Motion does not log or persist the Turnstile verification token.

Cloudflare Turnstile processes browser and device-environment signals needed to distinguish legitimate users from automated traffic. Cloudflare may use browser storage, cookies, short-lived identifiers or other security mechanisms as part of operating Turnstile.

2.6 Crash and error information

8D Motion uses Sentry to help identify crashes and technical errors.

Crash reports can include information such as:

• exception and error information;
• stack traces;
• technical app and device context; and
• information needed to understand the circumstances of a crash.

8D Motion is configured so that:

• Sentry’s default PII collection is disabled;
• no Supabase user ID or email address is deliberately attached to crash reports;
• Sentry user context is removed before events are sent;
• common email addresses, authentication tokens, user-home file paths and audio filenames are scrubbed from applicable error text;
• screenshots are not attached;
• performance tracing is disabled;
• session replay is not enabled; and
• Sentry is configured to prevent IP addresses from being stored for new events.

Crash reports are used only for reliability, troubleshooting and security purposes.

2.7 Transactional emails

8D Motion uses Resend as the email-delivery provider for Supabase authentication emails, including:

• email-address confirmation;
• password-reset messages; and
• related authentication emails.

Resend processes the recipient email address, message content and delivery information needed to send these emails.

Open tracking and click tracking are disabled for the 8dmotion.com sending domain.

Under Resend’s current retention policy for Free, Pro and Scale plans, email and log data is retained for 30 days. Resend states that backups are retained for 7 days.

2.8 Support communications

The 8D Motion website does not contain a support form. Selecting a support link opens your own email application.

If you choose to email support@8dmotion.com, 8D Motion receives the email address you send from, the contents of your message and any information or files you choose to include.

You should not send passwords, payment-card details, authentication tokens or other unnecessary sensitive information in support messages.

2.9 Website information and analytics

The public website at 8dmotion.com is hosted using Cloudflare.

8D Motion uses Cloudflare Web Analytics to understand aggregate website usage and performance, such as page views and how pages perform for visitors.

Cloudflare Web Analytics is designed to provide aggregate website analytics without using cookies or local storage for analytics and without creating cross-site advertising profiles.

8D Motion does not use Google Analytics, Meta Pixel or other advertising analytics on the website.

Ordinary website requests are also processed by Cloudflare as the hosting and network provider. This involves technical network information required to deliver and secure the website.

3. Information we do not use for advertising or tracking

8D Motion does not:

• display third-party advertising;
• sell your personal information;
• rent your personal information;
• use your information for behavioural advertising;
• use an advertising or attribution SDK;
• create an app-specific advertising or tracking identifier;
• use your projects or audio to build advertising profiles; or
• use your audio to train AI models.

The Android app does not request the Android Advertising ID permission.

8D Motion does not request Apple’s App Tracking Transparency permission because the app does not use data for cross-app advertising tracking.

Some technical libraries included with the app contain functionality that could support additional device capabilities. However, the production app does not enable the permissions required for advertising-ID access, location access, camera access or microphone access.

4. How we use information

We use personal information only as reasonably necessary to operate, secure and support 8D Motion.

This includes using information to:

• create and authenticate your account;
• maintain your authenticated session;
• send account verification and password-recovery emails;
• sync project and preset metadata between devices;
• provide and restore 8D Motion Plus;
• validate subscription ownership;
• prevent conflicting, fraudulent or abusive subscription claims;
• protect authentication systems against automated abuse;
• diagnose crashes and technical problems;
• maintain and improve the reliability and security of 8D Motion;
• respond to support requests;
• understand aggregate website usage and performance;
• process account-deletion requests;
• comply with legal obligations; and
• establish, exercise or defend legal rights where necessary.

We do not use your imported audio for advertising, profiling or unrelated analysis.

5. Why we process information and our legal grounds

We process personal information only for the purposes described in this Privacy Policy, including to provide the service, maintain accounts, sync project and preset metadata, manage subscriptions, protect the service, diagnose technical problems, respond to support requests and comply with applicable law.

The legal grounds that apply to processing can depend on where you live.

5.1 United Kingdom and European Economic Area

Where UK or EEA data-protection law applies, our principal legal bases are:

Performance of a contract

We process information where it is necessary to provide 8D Motion or a feature you have requested, including:

• account creation and authentication;
• cloud project and preset syncing;
• subscription functionality;
• purchase restoration;
• transactional account emails; and
• account deletion.

Legitimate interests

We process limited information where reasonably necessary for legitimate interests in operating a secure and reliable service, including:

• preventing fraud and abuse;
• protecting authentication systems;
• maintaining subscription ownership integrity;
• diagnosing crashes and errors;
• securing the website and backend;
• responding to support enquiries; and
• understanding aggregate website usage and performance.

When relying on legitimate interests, we consider the nature of the information involved, the reason for processing it and the impact on users.

We also seek to minimise the information processed for these purposes. Measures include keeping user audio local, avoiding advertising tracking, limiting identifiers, sanitising error data and preventing Sentry from storing IP addresses for new events.

Legal obligations

We may process information where necessary to comply with applicable legal obligations.

Consent

Where UK or EEA law requires consent for a particular processing activity, we rely on consent where appropriate.

Where processing relies on consent, you may withdraw that consent as permitted by applicable law.

5.2 Other countries and regions

Outside the UK and EEA, we process personal information on the grounds permitted by the privacy and data-protection laws that apply to you.

Depending on the jurisdiction and the type of processing, those grounds may include:

• providing a product or service that you requested;
• carrying out a transaction with you;
• operating and securing the service;
• preventing fraud or abuse;
• complying with legal requirements;
• pursuing legitimate business purposes permitted by law; or
• obtaining your consent where required.

Where local law provides additional protections or requires a different legal ground for particular processing, those requirements apply.

Nothing in this Privacy Policy is intended to limit privacy rights that cannot lawfully be excluded under the laws that apply to you.

6. Who we share information with

We use a limited number of service providers to operate 8D Motion.

Supabase

Used for:

• authentication;
• account management;
• project and preset metadata storage and syncing;
• Edge Functions; and
• 8D Motion’s subscription ownership backend.

Google

Used when you choose Google Sign-In and, on Android, for Google Play billing.

Apple

Used when you choose Sign in with Apple and, on iOS, for App Store billing.

RevenueCat

Used to communicate with Apple and Google subscription systems, manage purchase information and support subscription restoration.

Resend

Used to deliver transactional authentication emails.

Sentry

Used for crash and error monitoring.

Cloudflare

Used for:

• website hosting and delivery;
• Cloudflare Turnstile security checks; and
• Cloudflare Web Analytics.

Email service providers

If you contact support by email, the message is processed through the email services used by you and by 8D Motion to send and receive email.

We do not share personal information with third parties for their own advertising purposes.

Apple, Google and other platform providers may also process information as independent providers under their own privacy policies when you use their accounts, stores or payment services.

7. Data storage and international processing

8D Motion uses service providers that operate infrastructure in multiple countries.

As a result, personal information may be processed in a country different from the one in which you live.

Where applicable privacy or data-protection law requires safeguards for an international transfer, the relevant provider and/or 8D Motion uses legally recognised safeguards appropriate to that transfer.

Depending on the country and provider, these can include:

• adequacy decisions or recognised equivalent arrangements;
• standard contractual clauses;
• UK international data-transfer safeguards; or
• other transfer mechanisms permitted by applicable law.

The privacy terms and international-transfer arrangements of individual service providers may also apply to information they process on behalf of 8D Motion.

8. Retention

We keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, subject to the specific rules below.

8.1 Account data

Your Supabase account and live account-linked application data remain while your account exists, unless you delete particular content sooner.

When an 8D Motion account is successfully deleted, the Supabase Auth account and account-linked projects, presets and associated application records are deleted from the live 8D Motion database.

The current 8D Motion Supabase project does not use scheduled database backups or Point-in-Time Recovery.

This does not override any infrastructure-level retention that Supabase may independently apply to operational or security records under its service policies.

8.2 Deleted projects and presets

When an individual synced project or preset is deleted, the cloud row can remain temporarily as a deletion marker so that deletion can be correctly synchronised across devices.

Eligible tombstoned project and preset rows are automatically hard-deleted after approximately 90 days.

A minimal project/preset deletion-history record can remain while the account exists so that another device does not accidentally restore content that was intentionally deleted.

Those account-linked deletion-history records are deleted when the 8D Motion account is deleted.

8.3 Subscription records

Some subscription-chain information can remain after account deletion without the deleted account’s Supabase user ID.

This includes one-way HMAC-derived subscription/transaction keys and subscription lifecycle records used to:

• preserve store subscription integrity;
• support later Restore Purchases;
• prevent conflicting ownership claims;
• process subsequent renewal, expiry or cancellation events; and
• protect against subscription fraud or abuse.

RevenueCat is also instructed to delete the RevenueCat customer associated with the deleted 8D Motion account.

Deleting an 8D Motion account does not delete or cancel the underlying Apple App Store or Google Play subscription or the stores’ own purchase records.

8.4 Authentication and security logs

Supabase automatically generates authentication and operational security records. These can include information such as user ID, IP address, user agent and authentication events and are retained under Supabase’s applicable service-retention rules.

These records are separate from the live 8D Motion account tables.

8.5 Crash reports

Sentry retains crash and error reports according to the retention settings and policies applicable to the Sentry service.

8D Motion does not attach your Supabase account ID or email address to those reports, and Sentry is configured to prevent IP addresses from being stored for new events.

8.6 Authentication emails

Under Resend’s current retention policy for Free, Pro and Scale plans, email and log data is retained for 30 days. Resend states that backups are retained for 7 days.

8.7 Support correspondence

Support emails are retained only for as long as reasonably necessary to respond to the request, resolve related issues, maintain appropriate business records or comply with legal obligations.

9. Account deletion

You can request deletion from within the 8D Motion app.

When deletion succeeds:

• your Supabase Auth account is deleted;
• account-linked projects and presets stored in Supabase are deleted;
• account-linked project/preset deletion history is deleted;
• account-linked subscription purchase intents and ownership-history records are deleted;
• locally stored app-private projects and presets belonging to the deleted account are removed;
• locally stored pending-purchase recovery data belonging to the deleted account is cleared;
• the RevenueCat customer associated with the account is submitted for deletion;
• Sign in with Apple authorization is revoked for Apple-linked accounts;
• 8D Motion makes a best-effort request to revoke Google authorization for Google-linked accounts; and
• local authentication and account-specific caches are cleared.

Some subscription-chain records remain without your 8D Motion account user ID for the purposes explained in Section 8.3.

Account deletion does not:

• cancel an Apple App Store or Google Play subscription;
• delete Apple or Google’s own purchase records;
• delete original media files that you imported from outside 8D Motion; or
• delete exports that you saved outside 8D Motion’s private app storage.

You must cancel an active subscription through the applicable App Store or Google Play subscription-management system if you no longer want it to renew.

10. Security

We use technical and organisational measures intended to protect personal information and reduce unnecessary collection.

These measures include, where applicable:

• authenticated access controls;
• database row-level security;
• server-side validation of authenticated users;
• encryption in transit;
• restricted server-side credentials;
• HMAC-derived subscription identifiers instead of storing raw store transaction identifiers;
• privacy-focused error reporting;
• Cloudflare bot protection;
• limited device permissions; and
• ownership checks before deleting locally stored account data.

No internet-connected service can guarantee absolute security.

If you believe you have discovered a security or privacy issue, please contact support@8dmotion.com.

11. Your privacy rights

Depending on where you live, privacy and data-protection laws may give you rights over your personal information.

These may include rights to:

• obtain information about how your personal information is used;
• request access to personal information held about you;
• correct inaccurate information;
• request deletion;
• restrict certain processing;
• receive certain information in a portable format;
• object to certain processing;
• withdraw consent where processing is based on consent;
• opt out of certain uses of personal information where applicable; and
• complain to a privacy or data-protection authority.

The exact rights available to you, and any conditions or exceptions that apply, depend on the law in your jurisdiction.

To exercise a privacy right, contact:

support@8dmotion.com

We may need to take reasonable steps to verify that a request relates to you before acting on it.

If you are in the United Kingdom, you also have the right to complain to the Information Commissioner’s Office (ICO).

If you live elsewhere, you may have the right to complain to the privacy or data-protection authority responsible for your jurisdiction.

12. Children and young people

8D Motion is not intended for children under 13.

Users aged 13 to 17 must have permission from a parent or legal guardian to use 8D Motion.

8D Motion does not ask users to provide their date of birth and does not use personal information for targeted advertising or behavioural profiling.

We seek to minimise the personal information used by the service, and user audio remains local to the device rather than being uploaded to the 8D Motion cloud backend.

If we become aware that an account belongs to a child under 13 using the service contrary to this age requirement, we may take appropriate steps to remove the account and associated data.

A parent or legal guardian who has a privacy concern can contact support@8dmotion.com.

13. Automated decision-making

8D Motion does not use personal information to make solely automated decisions that produce legal or similarly significant effects on users.

Cloudflare Turnstile automatically assesses technical security signals to identify likely automated or abusive authentication attempts.

This assessment is used to protect authentication and does not create advertising or behavioural profiles.

14. Third-party services and links

8D Motion may contain links that open external services, including Apple, Google or other websites.

Once you leave 8D Motion or use a third-party service, that provider’s own privacy practices apply.

You should review the privacy information supplied by those providers if you want to understand how they independently process your information.

15. Changes to this Privacy Policy

We may update this Privacy Policy if:

• 8D Motion’s features change;
• our data-processing practices change;
• our service providers change; or
• legal or regulatory requirements change.

The latest version will be made available through 8D Motion and at 8dmotion.com.

The date at the top of this Privacy Policy shows when it was last updated.

If a change materially affects how personal information is used, we will take reasonable steps to make the change appropriately visible to users.

16. Contact

For questions about this Privacy Policy, privacy rights, account deletion or the way 8D Motion handles personal information, contact:

Jordan Markovics, trading as 8D Motion

27 Russel Croft
Bromsgrove
B60 3EF
United Kingdom

Email: support@8dmotion.com